CVE-2026-32828: 
NixOS vulnerability analysis and mitigation

CVE-2026-32828 is a Server-Side Request Forgery (SSRF) vulnerability in Kargo's built-in http and http-download promotion steps that allows authenticated attackers to make requests to link-local addresses, most critically the cloud instance metadata endpoint at 169.254.169.254. Affected versions include 1.4.0 through 1.6.3, 1.7.0-rc.1 through 1.7.8, 1.8.0-rc.1 through 1.8.11, and 1.9.0-rc.1 through 1.9.4. The vulnerability was published on March 20, 2026, and patched versions were released shortly after. It carries a CVSS v3.1 base score of 4.9 (Medium) and a CVSS v4.0 base score of 5.1 (Medium) (GitHub Advisory, Feedly).

The root cause is CWE-918 (Server-Side Request Forgery), where Kargo's http and http-download promotion steps execute outbound HTTP requests from the Kargo controller without restricting destination addresses to exclude link-local ranges (169.254.0.0/16 and fe80::/10). Critically, the http step grants full control over request method and headers, while http-download grants header control — both of which are sufficient to bypass cloud provider header-based SSRF mitigations (e.g., requiring a specific Metadata: true header). An authenticated attacker with permissions to create/update Stages or craft Promotion resources can submit a malicious Promotion manifest that directs the controller to query the instance metadata endpoint. The fix introduced a SafeDialContext function that resolves hostnames before connecting and rejects connections if all resolved addresses fall within link-local ranges (GitHub Advisory, Patch Commit).

Successful exploitation enables an authenticated attacker to exfiltrate sensitive data from cloud instance metadata endpoints, including IAM credentials, which could lead to unauthorized access to cloud infrastructure and services. Response data from the malicious HTTP request can be retrieved via Promotion status fields, written to a Git repository, or forwarded to an attacker-controlled server using a second http step. The impact is primarily a confidentiality breach against subsequent systems (cloud infrastructure), with no direct integrity or availability impact on Kargo itself (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Feedly). Exploitation requires authentication to the Kargo API server with non-trivial permissions (Stage create/update or Promotion crafting), which must be explicitly granted by a project administrator, limiting the attacker pool. The EPSS score is approximately 0.029%, reflecting low probability of near-term exploitation. No threat actor attribution or CISA KEV catalog listing has been identified for this vulnerability.

1. Reconnaissance: Identify a Kargo deployment running an affected version (1.4.0–1.6.3, 1.7.0-rc.1–1.7.8, 1.8.0-rc.1–1.8.11, or 1.9.0-rc.1–1.9.4) and obtain authenticated access with permissions to create/update Stages or craft Promotion resources.
2. Craft malicious Promotion manifest: Create a Promotion manifest that includes an http or http-download step targeting the cloud instance metadata endpoint, e.g., http://169.254.169.254/latest/meta-data/iam/security-credentials/.
3. Bypass header-based mitigations: In the http step configuration, set the required cloud provider headers (e.g., Metadata: true for Azure, or appropriate AWS IMDSv1 headers) to circumvent provider-side SSRF protections, since the step allows full header control.
4. Submit the Promotion: Submit the malicious Promotion manifest via the Kargo API. The Kargo controller processes it in-cluster and executes the HTTP request to the metadata endpoint.
5. Retrieve exfiltrated data: Collect the response (containing IAM credentials or other sensitive metadata) from Promotion status fields, a configured Git repository output, or a second http step that forwards the data to an attacker-controlled server (GitHub Advisory).

• Network: Outbound HTTP requests from the Kargo controller pod to 169.254.169.254 or other link-local addresses (169.254.0.0/16 or fe80::/10); unexpected connections from the Kargo controller to external attacker-controlled endpoints carrying metadata-like payloads.
• Logs: Kargo controller logs showing Promotion execution with http or http-download steps targeting link-local IP ranges; Kubernetes audit logs recording creation or update of Stage or Promotion resources by non-administrative users.
• Kubernetes Resources: Promotion resources with http/http-download steps containing URLs pointing to 169.254.169.254 or similar link-local addresses; Promotion status fields containing IAM credential data or cloud metadata responses.
• Git Repositories: Unexpected commits to configured Git repositories containing cloud metadata or IAM credential content written by the Kargo controller service account (GitHub Advisory).

Upgrade Kargo to one of the patched versions: 1.6.4, 1.7.9, 1.8.12, or 1.9.5, depending on the currently deployed branch. The fix introduces a SafeTransport wrapper with a SafeDialContext function that blocks all connections to link-local IP ranges (169.254.0.0/16 and fe80::/10) while continuing to permit private and internal address access. As interim mitigations, restrict permissions for creating and updating Stages and Promotion resources to trusted users only, and implement Kubernetes NetworkPolicies to block outbound traffic from the Kargo controller pod to link-local address ranges (GitHub Advisory, Patch Commit).

The vulnerability was reported by researcher maru1009 and coordinated by Kargo maintainer krancour, who published the GitHub Security Advisory on March 14, 2026. The advisory notes that all Promotion creation is audited with the creating user's identity recorded in annotations and Kubernetes events, providing a forensic trail. No significant broader media coverage or notable community commentary beyond the official advisory has been identified.